You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@hbase.apache.org by "Andrew Purtell (JIRA)" <ji...@apache.org> on 2013/12/21 03:36:09 UTC
[jira] [Updated] (HBASE-10220) TestVisibilityLabelsWithACL is not
setting up the minicluster correctly
[ https://issues.apache.org/jira/browse/HBASE-10220?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Andrew Purtell updated HBASE-10220:
-----------------------------------
Description:
TestVisibilityLabelsWithACL is not setting up the secure minicluster correctly. The user running the test is the superuser. However, a principal based on the user's account is created per virtual slave. We need to add all of these test accounts to the superusers list also, or it is as if someone deployed HBase with multiple service principals and didn't put them all into the superuserlist. (This also makes me suspicious about this test, it's not actually failing...)
You can see the issue here:
{noformat}
2013-12-20 18:25:44,979 WARN [htable-pool42-t1] client.AsyncProcess(664): #57, table=hbase:meta, attempt=1/350 failed 1 ops, last exception: org.apache.hadoop.hbase.security.AccessDeniedException: org.apache.hadoop.hbase.security.AccessDeniedException: Insufficient permissions (user=apurtell.hfs.1, scope=hbase:meta, family=info:server|info:serverstartcode|info:seqnumDuringOpen, action=WRITE)
at org.apache.hadoop.hbase.security.access.AccessController.requireCoveringPermission(AccessController.java:567)
at org.apache.hadoop.hbase.security.access.AccessController.prePut(AccessController.java:1139)
at org.apache.hadoop.hbase.regionserver.RegionCoprocessorHost.prePut(RegionCoprocessorHost.java:964)
at org.apache.hadoop.hbase.regionserver.HRegion.doPreMutationHook(HRegion.java:2131)
at org.apache.hadoop.hbase.regionserver.HRegion.batchMutate(HRegion.java:2106)
at org.apache.hadoop.hbase.regionserver.HRegion.batchMutate(HRegion.java:2062)
at org.apache.hadoop.hbase.regionserver.HRegion.batchMutate(HRegion.java:2066)
at org.apache.hadoop.hbase.regionserver.HRegionServer.doBatchOp(HRegionServer.java:4206)
at org.apache.hadoop.hbase.regionserver.HRegionServer.doNonAtomicRegionMutation(HRegionServer.java:3448)
at org.apache.hadoop.hbase.regionserver.HRegionServer.multi(HRegionServer.java:3352)
at org.apache.hadoop.hbase.protobuf.generated.ClientProtos$ClientService$2.callBlockingMethod(ClientProtos.java:28460)
at org.apache.hadoop.hbase.ipc.RpcServer.call(RpcServer.java:2008)
at org.apache.hadoop.hbase.ipc.CallRunner.run(CallRunner.java:92)
at org.apache.hadoop.hbase.ipc.SimpleRpcScheduler.consumerLoop(SimpleRpcScheduler.java:160)
at org.apache.hadoop.hbase.ipc.SimpleRpcScheduler.access$000(SimpleRpcScheduler.java:38)
at org.apache.hadoop.hbase.ipc.SimpleRpcScheduler$1.run(SimpleRpcScheduler.java:110)
at java.lang.Thread.run(Thread.java:744)
on acer,47702,1387592735459, tracking started Fri Dec 20 18:25:44 PST 2013 - FAILED, NOT RETRYING ANYMORE
2013-12-20 18:25:44,980 DEBUG [PostOpenDeployTasks:bdd47ebb21d762590edf81127c8cd30f] client.HTable(949): hbase:meta: One or more of the operations have failed - waiting for all operation in progress to finish (successfully or not)
{noformat}
was:
TestVisibilityLabelsWithACL is not setting up the secure minicluster correctly. The user running the test is the superuser. However, a principal based on the user's account is created per virtual slave. We need to add all of these test accounts to the superusers list also, or it is as if someone deployed HBase with multiple service principals and didn't put them all into the superuserlist. (This also makes me suspicious about this test, it's not actually failing...)
You can see the issue here:
{noformat}
2013-12-20 18:25:44,979 WARN [htable-pool42-t1] client.AsyncProcess(664): #57, table=hbase:meta, attempt=1/350 failed 1 ops, last exception: org.apache.hadoop.hbase.security.AccessDeniedException: org.apache.hadoop.hbase.security.AccessDeniedException: Insufficient permissions (user=apurtell.hfs.1, scope=hbase:meta, family=info:server|info:serverstartcode|info:seqnumDuringOpen, action=WRITE)
at org.apache.hadoop.hbase.security.access.AccessController.requireCoveringPermission(AccessController.java:567)
at org.apache.hadoop.hbase.security.access.AccessController.prePut(AccessController.java:1139)
at org.apache.hadoop.hbase.regionserver.RegionCoprocessorHost.prePut(RegionCoprocessorHost.java:964)
at org.apache.hadoop.hbase.regionserver.HRegion.doPreMutationHook(HRegion.java:2131)
at org.apache.hadoop.hbase.regionserver.HRegion.batchMutate(HRegion.java:2106)
at org.apache.hadoop.hbase.regionserver.HRegion.batchMutate(HRegion.java:2062)
at org.apache.hadoop.hbase.regionserver.HRegion.batchMutate(HRegion.java:2066)
at org.apache.hadoop.hbase.regionserver.HRegionServer.doBatchOp(HRegionServer.java:4206)
at org.apache.hadoop.hbase.regionserver.HRegionServer.doNonAtomicRegionMutation(HRegionServer.java:3448)
at org.apache.hadoop.hbase.regionserver.HRegionServer.multi(HRegionServer.java:3352)
at org.apache.hadoop.hbase.protobuf.generated.ClientProtos$ClientService$2.callBlockingMethod(ClientProtos.java:28460)
at org.apache.hadoop.hbase.ipc.RpcServer.call(RpcServer.java:2008)
at org.apache.hadoop.hbase.ipc.CallRunner.run(CallRunner.java:92)
at org.apache.hadoop.hbase.ipc.SimpleRpcScheduler.consumerLoop(SimpleRpcScheduler.java:160)
at org.apache.hadoop.hbase.ipc.SimpleRpcScheduler.access$000(SimpleRpcScheduler.java:38)
at org.apache.hadoop.hbase.ipc.SimpleRpcScheduler$1.run(SimpleRpcScheduler.java:110)
at java.lang.Thread.run(Thread.java:744)
on acer,47702,1387592735459, tracking started Fri Dec 20 18:25:44 PST 2013 - FAILED, NOT RETRYING ANYMORE
2013-12-20 18:25:44,980 DEBUG [PostOpenDeployTasks:bdd47ebb21d762590edf81127c8cd30f] client.HTable(949): hbase:meta: One or more of the operations have failed - waiting for all operation in progress to finish (successfully or not)
{noformat}
I think what I should do is take the code out of TestAccessController which handles this and put it into o.a.h.h.security.access.SecureTestUtil.enableSecurity and have this test use that.
> TestVisibilityLabelsWithACL is not setting up the minicluster correctly
> -----------------------------------------------------------------------
>
> Key: HBASE-10220
> URL: https://issues.apache.org/jira/browse/HBASE-10220
> Project: HBase
> Issue Type: Bug
> Affects Versions: 0.98.0, 0.99.0
> Reporter: Andrew Purtell
> Fix For: 0.98.0, 0.99.0
>
>
> TestVisibilityLabelsWithACL is not setting up the secure minicluster correctly. The user running the test is the superuser. However, a principal based on the user's account is created per virtual slave. We need to add all of these test accounts to the superusers list also, or it is as if someone deployed HBase with multiple service principals and didn't put them all into the superuserlist. (This also makes me suspicious about this test, it's not actually failing...)
> You can see the issue here:
> {noformat}
> 2013-12-20 18:25:44,979 WARN [htable-pool42-t1] client.AsyncProcess(664): #57, table=hbase:meta, attempt=1/350 failed 1 ops, last exception: org.apache.hadoop.hbase.security.AccessDeniedException: org.apache.hadoop.hbase.security.AccessDeniedException: Insufficient permissions (user=apurtell.hfs.1, scope=hbase:meta, family=info:server|info:serverstartcode|info:seqnumDuringOpen, action=WRITE)
> at org.apache.hadoop.hbase.security.access.AccessController.requireCoveringPermission(AccessController.java:567)
> at org.apache.hadoop.hbase.security.access.AccessController.prePut(AccessController.java:1139)
> at org.apache.hadoop.hbase.regionserver.RegionCoprocessorHost.prePut(RegionCoprocessorHost.java:964)
> at org.apache.hadoop.hbase.regionserver.HRegion.doPreMutationHook(HRegion.java:2131)
> at org.apache.hadoop.hbase.regionserver.HRegion.batchMutate(HRegion.java:2106)
> at org.apache.hadoop.hbase.regionserver.HRegion.batchMutate(HRegion.java:2062)
> at org.apache.hadoop.hbase.regionserver.HRegion.batchMutate(HRegion.java:2066)
> at org.apache.hadoop.hbase.regionserver.HRegionServer.doBatchOp(HRegionServer.java:4206)
> at org.apache.hadoop.hbase.regionserver.HRegionServer.doNonAtomicRegionMutation(HRegionServer.java:3448)
> at org.apache.hadoop.hbase.regionserver.HRegionServer.multi(HRegionServer.java:3352)
> at org.apache.hadoop.hbase.protobuf.generated.ClientProtos$ClientService$2.callBlockingMethod(ClientProtos.java:28460)
> at org.apache.hadoop.hbase.ipc.RpcServer.call(RpcServer.java:2008)
> at org.apache.hadoop.hbase.ipc.CallRunner.run(CallRunner.java:92)
> at org.apache.hadoop.hbase.ipc.SimpleRpcScheduler.consumerLoop(SimpleRpcScheduler.java:160)
> at org.apache.hadoop.hbase.ipc.SimpleRpcScheduler.access$000(SimpleRpcScheduler.java:38)
> at org.apache.hadoop.hbase.ipc.SimpleRpcScheduler$1.run(SimpleRpcScheduler.java:110)
> at java.lang.Thread.run(Thread.java:744)
> on acer,47702,1387592735459, tracking started Fri Dec 20 18:25:44 PST 2013 - FAILED, NOT RETRYING ANYMORE
> 2013-12-20 18:25:44,980 DEBUG [PostOpenDeployTasks:bdd47ebb21d762590edf81127c8cd30f] client.HTable(949): hbase:meta: One or more of the operations have failed - waiting for all operation in progress to finish (successfully or not)
> {noformat}
--
This message was sent by Atlassian JIRA
(v6.1.4#6159)